Blocked: this page cannot be embedded

Framing rules

• X-Frame-Options: DENYignored

  Browsers ignore X-Frame-Options here, because CSP frame-ancestors is set and wins.

• frame-ancestors 'none'deny

  frame-ancestors 'none' stops every site from showing the page in a frame.

• Set-Cookie × 1warning

  None of the 1 cookies go into a cross-site frame (geo): a cookie needs SameSite=None; Secure for that. A login or session inside the frame can fail.

• Cross-Origin-Resource-Policyabsent

  Not sent. A cross-origin page with Cross-Origin-Embedder-Policy: require-corp cannot embed it.

HTTP 200 OK
age: 0
cache-control: public, max-age=60
cf-cache-status: DYNAMIC
cf-ray: a579ac3d8f6fc69c-CMH
connection: close
content-security-policy: default-src 'self' https://*.apple.com; img-src 'self' https://*.apple.com https://*.apple-mapkit.com https://*.mzstatic.com data: blob:; style-src 'self' https://*.apple.com https://*.apple-mapkit.com 'unsafe-inline'; font-src 'self' https://*.apple.com data:; script-src 'self' https://*.apple.com https://*.apple-mapkit.com blob: 'unsafe-eval'; connect-src 'self' https://*.apple.com https://*.apple-mapkit.com https://*.applemusic.com https://*.mzstatic.com https://mediaservices.cdn-apple.com https://*.push.apple.com wss://*.push.apple.com data:; media-src 'self' https://*.apple.com https://*.applemusic.com https://*.mzstatic.com blob:; child-src 'self' https://*.apple.com https://apple.songshift.com music: musics: blob: itms: itmss:; frame-ancestors 'none'; block-all-mixed-content; report-uri /api/csp-report
content-type: text/html
date: Mon, 09 Nov 2026 03:18:54 GMT
etag: W/"UH9uwS+kCzK/fqrw5WAaZjJYczohNRB4x7HjQ0U/fwE="
link: <https://is1-ssl.mzstatic.com>; rel=preconnect, <https://mvod.itunes.apple.com>; rel=preconnect
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
transfer-encoding: chunked
vary: accept-encoding
via: 1.1 varnish
x-apple-jingle-correlation-key: H4VDLLTCSM2KBCVWDABMMJNOLA
x-cache: HIT fsly
x-cache-hits: 0
x-cdn: fsly
x-content-type-options: nosniff
x-daiquiri-debug-worker-pid: 363, 2119125
x-daiquiri-instance: daiquiri:10001:daiquiri-cluster-769bd8f496-92ndz:7987:26HOTFIX48:daiquiri-amp-kubernetes-shared-cluster-ak8s-prod-as4-amp-web-music-prod, daiquiri:10001:daiquiri-all-shared-ext-97948dd6-jrszh:7987:26HOTFIX48:daiquiri-amp-kubernetes-shared-ext-ak8s-prod-as4-amp-daiquiri-ingress-prod
x-frame-options: DENY
x-original-content-length: 443917
x-responding-instance: amp-web-music-server:amp-web-music-server-main-6fb78d868b-mv7k2:5000:2644.9.0-external
x-served-by: cache-cmh1290051-CMH
x-timer: S1794194334.356376,VS0,VE531
x-xss-protection: 1; mode=block
set-cookie: geo=…; domain=apple.com

Fetched from our server with a plain browser request. Headers can differ by region, or when you are signed in.